Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 956 of 1013.
- CVE-2026-107618 Gitea cross-site request forgery on repository topics
- CVE-2026-107617 Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials
- CVE-2026-107615 DLL search order hijacking via screenhooks libraries in TightVNC Server
- CVE-2026-107614 Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read
- CVE-2026-107613 NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization
- CVE-2026-107612 World-accessible IPC shared memory with predictable name in TightVNC Server
- CVE-2026-107611 Out-of-bounds read in TightVNC Viewer ZRLE palette decoding
- CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib
- CVE-2026-107607 Missing authentication for critical function in Swann Communications SWIFI-SE2KIC
- CVE-2026-107606 Missing authentication for critical function in Swann Communications SWIFI-SE2KIC
- CVE-2026-107605 Missing authentication for critical function in Swann Communications SWIFI-SE2KIC
- CVE-2026-107604 Missing authorization in Red Hat Build of Keycloak
- CVE-2026-1076 Star Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Update
- CVE-2026-107597 jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
- CVE-2026-107594 File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
- CVE-2026-107590 Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt
- CVE-2026-10759 BUG-000171040 Portal for ArcGIS has a security vulnerability
- CVE-2026-107589 Authentication Bypass by Spoofing in Jacamar CI
- CVE-2026-107588 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts
- CVE-2026-107587 Improper Certificate Validation in hMailServer
- CVE-2026-107586 Allocation of Resources Without Limits or Throttling in hMailServer
- CVE-2026-107585 Allocation of Resources Without Limits or Throttling in hMailServer
- CVE-2026-107584 Not Failing Securely ('Failing Open') in hMailServer
- CVE-2026-107583 Inefficient Algorithmic Complexity in hMailServer
- CVE-2026-107582 Inefficient Algorithmic Complexity in hMailServer
- CVE-2026-107581 Inefficient Algorithmic Complexity in hMailServer
- CVE-2026-107580 Inefficient Algorithmic Complexity in hMailServer
- CVE-2026-10758 Esri Lerc has a security vulnerability
- CVE-2026-107579 Inefficient Algorithmic Complexity in hMailServer
- CVE-2026-107578 Improper Link Resolution Before File Access ('Link Following') in hMailServer
- CVE-2026-107577 Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer
- CVE-2026-107576 Inefficient Algorithmic Complexity in hMailServer
- CVE-2026-107575 Inefficient Algorithmic Complexity in hMailServer
- CVE-2026-107574 Inefficient Algorithmic Complexity in hMailServer
- CVE-2026-107573 Incorrect Default Permissions in hMailServer
- CVE-2026-107572 Inefficient Regular Expression Complexity in hMailServer
- CVE-2026-107571 Incorrect Default Permissions in hMailServer
- CVE-2026-107570 Use of Out-of-range Pointer Offset in mutt
- CVE-2026-10757 BUG-000187511 - ArcGIS Server has a security vulnerability.
- CVE-2026-107569 Unchecked Input for Loop Condition in hMailServer
- CVE-2026-107568 Missing Authorization in hMailServer
- CVE-2026-107567 Use of Less Trusted Source in hMailServer
- CVE-2026-107566 Missing Authorization in hMailServer
- CVE-2026-107565 Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption
- CVE-2026-107564 gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption
- CVE-2026-10756 Security feature bypass in TRO600 Series Firmware
- CVE-2026-10755 All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration
- CVE-2026-10754 Security feature bypass in Pega Infinity
- CVE-2026-10753 Site Kit by Google < 1.176.0 - Editor+ Email Reporting Settings Update
- CVE-2026-10752 Missing authorization in Advanced Custom Fields: Extended
- CVE-2026-107510 Authenticated argument injection in NIOS command line leading to privilege escalation
- CVE-2026-10751 IBM MQ Java messaging is vulnerable to remote code execution
- CVE-2026-107508 Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
- CVE-2026-107507 Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit
- CVE-2026-107506 Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting
- CVE-2026-107503 Cross-site request forgery in Ditto Explorer UI
- CVE-2026-10750 Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools
- CVE-2026-1075 ZT Captcha <= 1.0.4 - Cross-Site Request Forgery to Settings Update
- CVE-2026-10749 Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaData
- CVE-2026-10748 Nexus Repository 3 - Remote Code Execution via License Deserialization
- CVE-2026-107472 Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt
- CVE-2026-10747 IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing
- CVE-2026-107466 Flatpak-builder: local file exfiltration via `file
- CVE-2026-107460 Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
- CVE-2026-107459 Openfind｜SecuShare Pro - OS Command Injection
- CVE-2026-107450 Missing authorization in Stump
- CVE-2026-10745 Other in upKeeper Instant Privilege Access
- CVE-2026-107449 Server-side request forgery in Heimdall
- CVE-2026-107448 Code injection in Magic: The Gathering Arena
- CVE-2026-107447 Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
- CVE-2026-107446 Integer overflow in overlaybd
- CVE-2026-107445 Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass
- CVE-2026-107444 Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass
- CVE-2026-10744 IBM MQ for HPE NonStop is vulnerable to a issue in MQINQ request validation
- CVE-2026-107437 Plaintext Database Password Exposure in GV-E-Map Server V18.2.0A
- CVE-2026-107436 WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability
- CVE-2026-107435 WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-107434 WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability
- CVE-2026-107433 WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
- CVE-2026-107432 WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability
- CVE-2026-107431 WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
- CVE-2026-107430 WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability
- CVE-2026-10743 IBM MQ Race Condition
- CVE-2026-107429 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability
- CVE-2026-107428 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-107427 WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-107426 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability
- CVE-2026-107425 WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability
- CVE-2026-107424 WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability
- CVE-2026-107423 WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability
- CVE-2026-107422 WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-107421 WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability
- CVE-2026-107420 Security feature bypass in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway
- CVE-2026-107419 WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability
- CVE-2026-107418 WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability
- CVE-2026-107417 WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability
- CVE-2026-107416 WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-10741 Nexus Repository Manager - Incorrect Authorization allows credential disclosure via proxy repository configuration
- CVE-2026-107406 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
- CVE-2026-107400 Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication